PT-2025-32008 · Unknown +1 · Security-Kit +1

Name of the Vulnerable Software and Affected Versions: Vision UI versions 1.4.0 and below security-kit versions prior to 3.5.0 Description: The getSecureRandomInt function contains a cryptographic weakness due to a silent 32-bit integer overflow in its internal masking logic. This prevents the...

OpenSynergy BlueSDK L2CAP Channel

The vulnerability of the OpenSynergy BlueSDK Bluetooth protocol lies in insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and create a L2CAP channel...

CVE-2025-45768

A flaw was found in pyjwt. The library uses weak encryption, allowing an attacker to potentially decrypt sensitive data. A network-based attacker can exploit this vulnerability without authentication, possibly resulting in a denial of service or data exposure. This weakness stems from the use of...

PT-2025-31584

Name of the Vulnerable Software and Affected Versions php-jwt version 6.11.0 Description php-jwt version 6.11.0 contains a cryptographic weakness. This weakness enables potential token manipulation. Recommendations At the moment, there is no information about a newer version that contains a fix f...

Apple macOS 安全漏洞

Apple macOS Sequoia and Apple macOS Sonoma are both operating systems from the American company Apple. A security vulnerability exists in Apple macOS Sequoia and Apple macOS Sonoma, which stems from an insufficient configuration restriction, and can be exploited by an attacker to cause...

Palo Alto Networks GlobalProtect App macOS DoS

The vulnerability of the software for providing secure remote access to data through the Palo Alto Networks GlobalProtect App for operating systems on macOS is related to deficiencies in access control. Exploiting this vulnerability could allow a attacker to cause service interruptions...

JetBrains TeamCity Unauthorized Access

The vulnerability of the TeamCity VCS configuration in continuous integration and delivery systems is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information from a remote location...

Tenda AC18 Router Samba SMB Config Bypass

The vulnerability of the smb.conf configuration file /etc-ro/smb.conf of the Tenda AC18 router-based Samba server is related to weak password requirements. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and gain unauthorized access to protected...

Lighttpd CGI Code Execution

The vulnerability of the reboot and restore functions in the /cgi-bin/lighttpd.cgi microprogramming system of LB-LINK routers is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

GitLab Authentication Bypass Info Disclosure

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

NewStart CGSL MAIN 7.02 : tracker-miners Multiple Vulnerabilities (NS-SA-2025-0139)

The remote NewStart CGSL host, running version MAIN 7.02, has tracker-miners packages installed that are affected by multiple vulnerabilities: - libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array access. A user of...

MyHeat GO API Unauthorized Access

The vulnerability of the API interface of the MyHeat GO boiler controller is related to the use of default login credentials. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the controller by using the standard login credentials...

git: Git arbitrary file writes

A bundled uri handling flaw was found in Git. When cloning a repository, Git knows to optionally fetch a bundle advertised by the remote server, which allows the server side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles,...

hMailServer 安全漏洞

hMailServer is an open source mail server from hMailServer Open Source. A security vulnerability exists in hMailServer version 5.8.6 and 5.6.9-beta, which stems from the use of a hard-coded key in Encryption.cs, which may lead to decryption of other server passwords...

MySQL Server DoS

The vulnerability of the MySQL Server component of the database management system’s optimizer is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker to cause service interruptions using the MySQL network protocol...

Eluktronics Control Center 数据伪造问题漏洞

Eluktronics Control Center is a control center software from Eluktronics Corporation. A data forgery issue vulnerability exists in Eluktronics Control Center version 5.23.51.41, which stems from insufficient validation of data authenticity in the REG File Handler component...

OpenSSL 安全漏洞

OpenSSL is an open source general-purpose cryptographic library capable of implementing the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols from the OpenSSL team. It supports a variety of cryptographic algorithms, including symmetric ciphers, hashing algorithms, secure...

XXL-JOB 安全漏洞

XXL-JOB is a distributed task scheduling platform by the individual developer Xu Xueli xuxueli. A security vulnerability exists in XXL-JOB 3.1.1 and earlier versions, which stems from an insufficient password hash calculation in the Token generation component...

CVE-2025-45156: Undefined Security Weakness

Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users...

Oracle WebLogic Server Data Access

The vulnerability of the Web Container server component of the Oracle WebLogic Server application is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain read, modify, or delete access to data...